#!/bin/sh
# bolt 一键安装脚本(POSIX sh,需 root + systemd)
#
# 用法(在目标设备上):
#   方式 A - 从 Gitea Release 下载二进制并安装:
#     curl -fsSL https://git.jocay.qzz.io/jocay/bolt/raw/branch/main/deploy/install.sh | sh -s -- --http 0.0.0.0:8080 --token 你的令牌
#     (私有仓库下载附件需要认证: 脚本会用 --token 同时作为下载凭据;或先 export BOLT_DL_TOKEN=xxx)
#   方式 B - 已把二进制拷到目标设备(如 scp):
#     ./install.sh --binary ./bolt --http 0.0.0.0:8080 --token xxx --allow "git,docker"
#
# 选项:
#   --http <addr>     监听地址,默认 127.0.0.1:8080
#   --token <t>       HTTP Bearer 认证令牌(监听公网时必填)
#   --allow <a,b>     命令白名单
#   --deny <a,b>      命令黑名单
#   --timeout-ms <n>  命令默认超时(默认 30000)
#   --binary <src>    二进制来源:本地路径 或 http(s) URL(默认从 Gitea Release 下载)
#   --no-start        只安装不启动
#   --no-enable       不设置开机自启
set -u

HTTP_ADDR="${HTTP_ADDR:-127.0.0.1:8080}"
TOKEN="${BOLT_TOKEN:-}"
ALLOW=""
DENY=""
TIMEOUT_MS="${BOLT_TIMEOUT_MS:-30000}"
BINARY_SRC=""
NO_START=0
NO_ENABLE=0

while [ $# -gt 0 ]; do
    case "$1" in
        --http) HTTP_ADDR="${2:-}"; shift 2 ;;
        --token) TOKEN="${2:-}"; shift 2 ;;
        --allow) ALLOW="${2:-}"; shift 2 ;;
        --deny) DENY="${2:-}"; shift 2 ;;
        --timeout-ms) TIMEOUT_MS="${2:-}"; shift 2 ;;
        --binary) BINARY_SRC="${2:-}"; shift 2 ;;
        --no-start) NO_START=1; shift ;;
        --no-enable) NO_ENABLE=1; shift ;;
        *) echo "未知参数: $1"; echo "用法见脚本头部注释"; exit 1 ;;
    esac
done

BIN_PATH=/usr/local/bin/bolt
ENV_FILE=/etc/bolt.env
UNIT_FILE=/etc/systemd/system/bolt.service
DL_URL="${BOLT_DL_URL:-https://git.jocay.qzz.io/jocay/bolt/releases/download/v0.1.0/bolt-linux-amd64}"

say()  { printf '\033[1;32m[bolt]\033[0m %s\n' "$*"; }
die()  { printf '\033[1;31m[bolt] 错误:\033[0m %s\n' "$*"; exit 1; }

[ "$(id -u)" -eq 0 ] || die "需要 root 权限"
command -v systemctl >/dev/null 2>&1 || die "未检测到 systemd"

# ---------- 1. 获取二进制 ----------
if [ -n "$BINARY_SRC" ]; then
    if [ -f "$BINARY_SRC" ]; then
        say "使用本地二进制: $BINARY_SRC"
        install -m 0755 "$BINARY_SRC" "$BIN_PATH"
    elif echo "$BINARY_SRC" | grep -q '^https\?://'; then
        say "下载二进制: $BINARY_SRC"
        rm -f /tmp/bolt-dl.$$
        if command -v curl >/dev/null 2>&1; then
            if [ -n "${BOLT_DL_TOKEN:-}" ]; then
                curl -fsSL --retry 3 -H "Authorization:token ${BOLT_DL_TOKEN:-}" -o /tmp/bolt-dl.$$ "$BINARY_SRC" || die "下载失败"
            else
                curl -fsSL --retry 3 -o /tmp/bolt-dl.$$ "$BINARY_SRC" || die "下载失败"
            fi
        elif command -v wget >/dev/null 2>&1; then
            wget -qO /tmp/bolt-dl.$$ "$BINARY_SRC" || die "下载失败"
        else
            die "需要 curl 或 wget"
        fi
        install -m 0755 /tmp/bolt-dl.$$ "$BIN_PATH" && rm -f /tmp/bolt-dl.$$
    else
        die "二进制来源不存在: $BINARY_SRC"
    fi
else
    say "从 Release 下载: $DL_URL"
    rm -f /tmp/bolt-dl.$$
    if command -v curl >/dev/null 2>&1; then
        if [ -n "${BOLT_DL_TOKEN:-}" ]; then
            curl -fsSL --retry 3 -H "Authorization:token ${BOLT_DL_TOKEN:-}" -o /tmp/bolt-dl.$$ "$DL_URL" || die "下载失败(私有仓库需 export BOLT_DL_TOKEN 或 --token)"
        else
            curl -fsSL --retry 3 -o /tmp/bolt-dl.$$ "$DL_URL" || die "下载失败(私有仓库需 export BOLT_DL_TOKEN 或 --token)"
        fi
    elif command -v wget >/dev/null 2>&1; then
        wget -qO /tmp/bolt-dl.$$ "$DL_URL" || die "下载失败"
    else
        die "需要 curl 或 wget"
    fi
    install -m 0755 /tmp/bolt-dl.$$ "$BIN_PATH" && rm -f /tmp/bolt-dl.$$
fi
"$BIN_PATH" --help >/dev/null 2>&1 || die "二进制不可执行: $BIN_PATH"
say "二进制就绪: $BIN_PATH ($("$BIN_PATH" --help | head -1))"

# ---------- 2. 写入环境配置 ----------
say "写入配置: $ENV_FILE"
printf '# bolt 服务配置,修改后 systemctl restart bolt\n' > "$ENV_FILE"
if [ -n "$TOKEN" ]; then
    printf 'BOLT_TOKEN=%s\n' "$TOKEN" >> "$ENV_FILE"
fi
if [ -n "$ALLOW" ]; then
    printf 'BOLT_ALLOW=%s\n' "$ALLOW" >> "$ENV_FILE"
fi
if [ -n "$DENY" ]; then
    printf 'BOLT_DENY=%s\n' "$DENY" >> "$ENV_FILE"
fi
[ -z "$TOKEN" ] && [ -z "$ALLOW" ] && [ -z "$DENY" ] && \
    printf '# 默认无认证无白名单;监听公网时请设置 BOLT_TOKEN 与 BOLT_ALLOW\n' >> "$ENV_FILE"

# ---------- 3. 写入 systemd 单元 ----------
say "写入服务单元: $UNIT_FILE"
cat > "$UNIT_FILE" <<UNITEOF
[Unit]
Description=bolt - 极速单文件 MCP 命令执行服务器
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=$BIN_PATH --http $HTTP_ADDR
EnvironmentFile=-$ENV_FILE
Restart=on-failure
RestartSec=2
TimeoutStopSec=10
StandardOutput=journal
StandardError=journal
SyslogIdentifier=bolt
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
UNITEOF

# ---------- 4. 注册并启动 ----------
systemctl daemon-reload
if [ "$NO_ENABLE" -eq 0 ]; then
    systemctl enable bolt >/dev/null 2>&1 && say "已设置开机自启"
fi
if [ "$NO_START" -eq 0 ]; then
    systemctl restart bolt
    sleep 1
    systemctl is-active bolt >/dev/null 2>&1 || { systemctl status bolt --no-pager -l | tail -15; die "服务启动失败"; }
    say "服务运行中: http://$HTTP_ADDR/mcp  $(systemctl show -p MainPID --value bolt)"
    [ -n "$TOKEN" ] && say "认证: Authorization: Bearer $TOKEN"
else
    say "已安装(未启动),执行 systemctl start bolt 启动"
fi
say "完成!管理: systemctl status bolt | journalctl -u bolt -f | systemctl restart bolt"